hello all - to the point So drives in question are a 128gb M2 ssd, and a 2.5" SSD, 240gb. Not sure if TRIM is enabled. Computer stolen. New OS installed on M2. Other ssd doesn't show up at all under My PC. Recovered computer via GPS, and seems like it wasn't used at all. No new programs or files installed, only used to watch youtube and such when I browsed the history.

I have encrypted .dat files, text on desktop 'sticky note' program, and encrypted notepad file that I need to recover.

The 2.5" drive does not show up in windows explorer, but found it in disk management. Says its empty.

https://gyazo.com/9fd29927cbc37114aeef4ceddcd80489 Just purchased basic SATA to USB converters, and my next plan was to clone the drives and run a slew of data recovery programs to see if anything can be located. Then its time for the professionals. Any suggestions on where to start?

Will home recovery programs be able to find data I'm looking for on either drive from a clone? I have no problem at all sending anyone who helps me successfully retrieving the data a bit of BTC. After days of searching forums and reading articles, this seems like the place to be. Thank you so much for your time and any expertise is appreciated.

valeu, after searching around quite a bit for which cloning software to use, I was continually directed right back here to hddguru's raw copy tool. Nice

The one thing I am unsure about is if the cloning process itself will write any data to the drives, as I didn't notice any type of write blocker or read only feature. This is terrifying to me, as I realize that any data overwritten could potentially be lost forever. I made one clone of the 2.5" drive and hopefully that will be sufficient.

So the first recovery software I ran was Recuva. Normal scan took like 30 seconds and did not retrieve anything.

Deep scan took 1.5 hours and didn't retrieve anything - just completely blank, found zero files. This is for the 2.5" drive which may be slightly less likely to have the files I am looking for. I kept OS and SQL database stuff on the M2 ssd on that machine. Desktop Sticky note program should be on the same drive as the OS, desktop notepad file should be same drive as OS, and .dat file was from a downloaded application - this may or may not be on the drive I just cloned/scanned - as I tried to keep most programs there.

Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.

Will ask some local companies tomorrow about their process and services before just flying back to USA and getting trusted professionals to work on things. Any advice moving forward?

This data is fairly important and I am willing to go anywhere in the world to have it recovered.

ok, easeus looks to have recovered a bunch of stuff. Note that I made the clone right onto a folder of my current desktop. Looking through dates some of these files don't seem possible. Getting late now and I'd like a fresh mind to start digging through this, but will pay for the program tomorrow and see what pops out. Browsing files for 15 minutes and nothing much is coming through - a couple pictures, and a pdf file that I created NOT on the drive, but on this current computer like 2 weeks ago. So it seems like easeus might be mixing some things up and combining the 2 drives somehow, even though I pointed at a folder with ONE file in it - the clone copy of my HD.

its almost 80k files - how should I be trying to locate what I need? Nothing came up in searches for .dat, microsoft, stickynotes, .txt. The name of the application which holds the .dat file also had nothing come back when searching for it.

one good thing is - my current new computer has only one hard drive in it, and it only 90gb. So at least some of the data must have been from the ssd drive in question. I'm finding random pictures from websites I visited today only though, so going to have a lot of stuff to dig through. My first hypothesis is that the files I'm looking for are all actually located on the ssd M2 drive which I have not yet cloned. I suppose my next step is to buy that cable and clone the other drive. In the meantime will purchase easeus and start searching

I'm getting almost zero support from data recovery 'professionals' in both bangkok and singapore. I've been told everything from they just can't help me with a drive that has been formatted, to they won't give me a single detail into their 'proprietary' systems of data recovery when I ask what types of software and hardware they use, if they do binary code extraction, and if they use non-invasive techniques in order to attempt data recovery. I hate to be the ugly american with high expectations, but I'm going to be paying thousands of dollars for a service, and anyone is asia isn't even letting me know what that service pays for or if they are going to destroy my drives in the process. Firms in North America on the other hand have spent plenty of time answering my questions and giving me advice. It's my last resort, but a couple 30 hour plane journeys may be in order soon. Hoping to make a bit of progress myself with recovery software before it comes to that.

Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone. Do a sector by sector copy without any sort of compressing and if you chose to image instead make sure you are not saving the image in any properiatary format. Now run your logic recovery software on the clone/image.

You should try R-Studio, GetDataBack, UFS - Recovery Explorer Professional, etc .... Save the data that you can to another drive.

This of course assuming that the data is still there, that TRIM was not enabled, that space was not over-written, etc ....

On the SSD the chances for logic recovery (or any recovery at all) are very low ...

Sorry for the late bump. I had finally sent the drive in, and was told:

Our engineers report that this volume has suffered from logical corruption which has resulted in loss of access to the data files.We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.

Not sure how to interpret this news, or if it means that they expect the same exact results for $2,000 that I got for free, which is the image listed above - 80k raw files that are not decipherable at all. I calc'd it would take 55 days straight to go through each and every file, assuming it takes 1 minute to decompress/unzip/and look thru each one.

Plug the "formated" drive and image it to a raw uncompressed binary image file using something like R-Studio, DMDE, WinHex, whatever or if you want to you can as well clone the drive to another one using ddrescue or hddsuperclone.

In a case like this, plugging a storage device on a Linux system to perform the image/clone would be preferable, as Windows will automatically mount partitions and may write data on them. I'm not sure if or how it affects the “trim” function though.

Quote:

We are expecting a File Type recovery with loss of file and folder names. The files will be sorted by types of files and chronologically.

If the medatada is lost (no file and folder names, meaning that the MFT has been completely wiped), then the files obtained by “raw” recovery can not be sorted “chronologically”, as the timestamps are also stored as metadata (or it's just the chronological order in which they were recovered, but that's completely irrelevant).

Quote:

Trying easeus next, and then R-studio, but not expecting much if recuva found absolutely nothing during a deep scan.

Recuva is quite good (especially considering that it's a free software) at analyzing NTFS structures and displaying anything that can be recovered using the metadata (found in the MFT). It's quite limited on the other hand for “raw” file recovery ; it recognizes few file types compared with R-Studio or the Easus software (which I haven't tried, it looks quite powerful in that regard, but the way the result is displayed is a mess compared with R-Studio, which classifies the file types in a convenient hierarchy of its own).

But if you still have that image you could also try Photorec : it's free and does “raw” file recovery, you can select the file types you want and uncheck the others (which might improve the result, in some cases it reduces the risks of false positives and truncated files). For some file types it performs better than R-Studio. To run Photorec on a drive image (as opposed to a physical device), either run the command : photorec.exe [path and name of the image], or right click on the image, “open with”, then select the photorec executable to open it.

You could also open your image with WinHex, and perform a thorough search with one or more keywords you remember from the files you're after (it has an option to search for several keywords at once and list the results). Or search through the files you already extracted with something like TotalCommander (it's just the software I use for that purpose, it does many things and does them well, there are specialized tools which may be more convenient – any of them will be more convenient than Windows built-in search function !). But if those files you're looking for are encrypted, or are natively in a compressed / proprietary format which doesn't let the text appear plainly in the data stream, obviously this won't work.

You could open a few files encrypted in the same way as those you're after and look for particular patterns (in the header and/or footer, i.e. the first and last sectors), then either create a custom file signature in R-Studio, or manually search the image using WinHex with keywords based on those patterns.

As for the time it would take to look through each and every one of those files : you only need to look at the ones from the relevant types, obviously you won't find anything useful in TTF files as on your screenshot !

Format usually trims all the data, the only option for recovery is to work with raw data from the chips(through vendor commands) which almost nobody can or want to do.Also garbage collector on an SSD will eventually erase even that "unavailable" data.

Doomer, can a software as CnW Recovery help to recover RAW data on flash drives?I know it can recover fragmented raw files through metadata searching, but i don't know if it might help for flash drives.What's your opinion?

Who is online

Users browsing this forum: No registered users and 0 guests

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot edit your posts in this forumYou cannot delete your posts in this forumYou cannot post attachments in this forum